gotta go don't introduce it will just go
grab my
pasta pasta all right let's send mr.
Pease dancer and it's two o'clock now
since the liberal always just a big
boost in the clipping yes Sam let's just
them give a million for you guys more
than anything else let's just see I'll
try to stay still in all right good
afternoon rest everybody's bill and
there's Michael hard let's talk about I
hadn't believe I'm doing this I'll be
honest with a history well I mean
seriously ever seems like yesterday we
started this stuff it is really really
freakiest time as I going back to like a
high school reunion or something and
it's kind of really really weird I'm
gonna get stuck in service official PMI
rose you learn memory or those are I
haven't met yet and Michael held where's
my email best ice cream in the light
little bit they've just easier to see
the quite a bit of material moving on
feel free to email me if you have any
questions at all or comments or whatever
so well as subtle isn't it
I guess we're done so a bit microsoft i
can't believe this i will it make
something up in nineteen years all I've
been involved in security for the
longest time was always things like SIDS
and privileges and ackles and crypto and
permissions and user tokens and desktop
tokens and all that sort of crud and
then a bit of us decided to focus on
security as in threats and that's really
how we evolved was the current group and
I've been involved with the bikes after
stl the secures remember life cycle
since day one me and Steve let me my old
boss we kind of kicked things off with
the SDR and the team which was
originally two people has now grown to
probably north of 130 people inside of
Microsoft and along the way really
couple bucks per most well-known is
running secure code the spider name is
still selling very well blows me away I
don't tell a wife that way because
she'll just want to spend the proceeds
so yeah um you should be used to wear it
over the SDF it's at Microsoft saying
it's easy put a well aware of every
second Tuesday you're very well aware of
the MSR see the mexis Security Response
Center or with the malware protection
Center as well open the other side of
the company is the security engineering
group which is private trustworthy
computing group and we have things like
security science I'll talk about that in
a minute as well as the stl the team
looks after the processes of Michael
security and privacy engineering
processes and Microsoft so the sdl the
goals of the SGR mr. I'm sure many of
you have to read some too unless you own
these heard or read some of the
propaganda the base
those of the SDR to fold everything
drives these two I'm a huge believer and
having overarching vision for what you
want to do otherwise is there a stumble
through life and do things are probably
not very beneficial so the goals of the
sdl art roof on new goals have been that
way since day one there are reduce
mental abilities in the code and reduce
the severity of the ones that you miss
because you're never going to get
everything as long as attack of the
drawing breath you will never get
everything because there's an initial is
constantly evolving and so everything
drives that like when everyone has a
penniless were selling less dr we have
two questions we're in a bugs will it
add defenses will reduce the severity of
a bulletin that the answer is no it's
just cruel it's not going the SDR it's
really that's that simple in fact anyone
appoint a wsdl is that we will remove
things from stl if they're no longer
proving to be beneficial and so the key
principles a big believer miss
prescriptive yet practical again this
really boils down to if it's not
practical if it doesn't really work then
just don't bother if it's not practical
in other words it is just going to bitch
and moan about something being bad
coding practice but not have a good
solution it's no bearing in the SDR you
can't just tell people that's just
really really bad you go so that's
really really bad and here's a great
solution to fix it here's the way you
should fix in his tools that you can run
to verify that your fixed it or even
better you ever have the problem in the
first place right for the goal of the
SDR let's a little points out there's a
big Garvey sdl isn't just finding and
fixing bugs it's preventing them in the
first place well that's engineering yeah
but finding a thousand bugs and say
hello with them and pics at bowling bugs
there's nothing to be proud of with that
in my opinion yeah I've heard somewhere
competitors state so that you know the
last ten years we thousand fix 1000
security vulnerabilities hoorah for not
letting repair up guys I blow the
biggest indicator
we found for the member security bugs
post ship is the lender Bugsy fine pre
ship if you find a bucket load of bugs
in some code and you feel proud you
found a bucket load of bugs guess what
you've got a bucket load of bugs you've
missed if you find you here you actually
go through a whole bunch of code you
find very very few bugs the initial
response when some people would be oh my
god we haven't found many bugs you know
the code is crap where our test as a
crap but relationship you probably have
better quality code well the biggest
indicator that we've found is a number
of bugs you find pre ship is a very good
indicator of how many budget will find
potion so and yes do come is the whole
of the microsoft development lifecycle
everything from literally conception all
the way through to death of the product
but social everything mike's up now is
test five EST is a extremely rare to
have a product that does not touch by
the sdl oh let me go through a metal
group email an herb herb very much as
the security science group at microsoft
we hire a lot of researchers like a good
example that Mara we hide him couple
years back he has been very very
instrumental in a lot of window defenses
that you'll see Kem Sokha in windows 7
and similar coming out windows 8 he's
been very very involved with a lot of
those defenses and baited the jobless
the science team is pretty straight
forward is to come mr. analyze current
threats that we know try to predict
future threats that we don't know about
yet and come up with ways of mitigating
those threats so April is adding into
the OS or adding some them to visual
studio they're adding some new libraries
or deprecating old functionality was
pretty much an open field in terms of
what we do in the security science
landscape Timothy and sdl a history
again it seems pretty
keep doing this Ashley because I this
seems like yesterday that we were doing
this stuff I'm like surfers are involved
in security we have been very very busy
since the earliest days of Windows NT
with Common Criteria evaluations and so
it's always been sort of a security
focus so a lot of this adoption of
security and power groups prior to SD
other was very very uneven some groups
so got religion a lot easier than a lot
earlier than other groups I'll be frank
I think a lot of people would back me up
on this one I think most software
vendors and we still see this today only
start to really focus a lot on pure
software security when their customers
start complaining customers ain't
complaining just keep givin just keep
spoon-feeding the customers right that's
what it is and so the customers start
complaining said we need you to improve
your game they're not going to prove the
game it's pretty rare I've seen some
companies do it I already done it
without customers complaining but it's
pretty rare unfortunately so back in the
early days it was pretty spotting some
point of use to better than others then
the whole it was pretty ragged Vanessa
before the nights over Richard software
security but it feels like you know
privileges and certain tackles and
tokens and firewall crypto a lot sort of
stuff well also around the windows 2007
frame just before we look 2000 ship this
is when our group started to grow and so
so it's an acceptably learned some of it
go this way into it was 2000 but again
it was really uneven and we know when
those two thousand was like right we can
possibly from a security standpoint know
the crazy thing is that the listed
thousand was chock-full of security
features he had certificate server it
had active directory they had group
policy up the wazoo right at home
ipsec it had those security technologies
therefore it was secure that it had many
many security vulnerabilities and spell
it years old adage right just bolting on
security features is not going to make
your product secure from attack and so
this is why you're our group is started
focusing on security as in threats not
security as in security features and the
nurse inventus includes drive at this
point and as a paper is really
internally called the threats to our
products and this this paper was up
inside makes of like a similar paper and
is really is looking at one out of
threats to the products there's a mean
to have a province under threat on the
risk of attack and then we send a sort
of codifying the methods of attack and
it is very rough there's very inventive
signal stripe spiritually maybe attacker
wants to do spoofing temple repudiation
information disclosure denial of service
an elevation of privilege then give CIA
30 more fine-grained and looking from
attackers perspective as opposed to a
defenders perspective that's essentially
what stride was the joke by the way is
that the reason about repudiation in
there is that other wise it would be
diets which doing quite you know the
same thing um we also embed this Utley
the universal bug bar this I think is
one of the most important if you ever
did which was coming up with the concept
of critical important moderate and low
severity vulnerabilities because Noel
bugs are alike a buffalo when people
hear the word buffer overrun and really
scared the thing is you can't get that
code and all right over there some code
that I wrote when I was 20 years old and
there's about 30,000 lines of sea and
it's completely secure completely secure
is the code great quality C code it's
not bad it has both all runs in it it
does
but the crazy thing is completely secure
because it's not networked it doesn't
let me Mellon 80 privileges literally
bunkie at all so dumb game that's pretty
cool guy eventually but and then it's
funny because it's completely secure
because it's absolutely isolated the
worst he can do is attack yourself which
is hardly exciting so the big bug bar it
was our first look at how do we define
the severity of a security vulnerability
and we also started recording else's I
am a massive believing root cause
analysis and we will continue to do this
to this day why did we make that mistake
what happened and so what we do is that
I spent the u.s. yes been almost three
months going over the last three years
of em SRC bulletins the area mess I see
available getting every CVE out of each
of beach bulletins and the Saudis ewwies
to each of the sea views and you're like
a little annotation to another issue I
need Joe be happy then I'm despite a
good as a reason to doing that so I'm so
getting ahead of myself it up deal
anyway well also did it look to all all
the stl requirements and assign cwe to
bearers in other words what kinds of CW
ease is that requirement mention it
again and then go through the msse
built-ins a server cv CW ease evaristo
heaven is there mismatch this a very
important thing I think to find out what
gaps we have in the SDR yeah yep
hello okay so this really going in the
big room Jojo jasmine back into the big
room CVC w/e common vulnerability
animation so common votes and exposures
and common weakness enumeration since
the CVE is like a unique key that's
giving birth availability and cwe is a
weakness like for example a memory
corruption then belief that there may be
you know classic buffer overrun or
integer arithmetic kind of issues
there's a very new mating weaknesses but
I'm a huge believer in doing repos
analysis if you will not do it cause
analysis of bugs that you are fighting
either within your own organizations or
any of your customers they should be
doing it it's not rocket science and
frankly if you don't understand the bugs
that you are that you're creating you
will never get rid of them over time you
just won't because you don't know the
problems are couple years back Hugh
Thompson episodes of the ISA and this
exact subject and I know how many of you
know Hume is from Bermuda it's pretty
laid back man you know it's like really
sort of pretty laid-back me let love
your bugs eyes are really bad hugh
thomas impression of Missouri but
basically i love your blogs is like I'm
never quite go that far but understand
the mistakes that you're making we also
build a cameras point proven Trevor an
arrow to call prefix which was a
interprocedural static analysis tool for
c and c++ and it was the first real task
analysis like powerful that allows to
live every user microsoft and with them
berger up a barrier for vogue is totally
by then it was a very hanging fruit it
really was low hanging fruit so um those
and you know as you probably a very well
aware you have malware especially in the
film of worms was pretty much random
Rico read member for example in 2001 and
part of this led to the trustworthy
committee member from bill gates I will
go through this whole series of events
in a bit more detail shortly but
essentially what it was was date saying
okay with outside the security and
privacy stuff by that my building
features so he take him very seriously
now bills memos are very very rare so
hurt them to put this out was a big was
a big deal I mean basically gave our
group owners carte blanche to do
whatever the heck we wanted with any
reason and the exact time down are built
into this at the end of two thousand one
we have this oak with a bed net security
personal ethical to done that security
stand down a little i was called that
but it's really fascinating because
paradise think we've done that but a
girl from have been built from the
ground up with security in mind how to
write have this the sandbox libya and
verification of code before he's
executed so on and so forth so if bill
for security in mind we went about its
around october two thousand one with
files and security box than with other
framework so that sucks because here we
have this theorem is built into the
security brand-spanking-new right vision
one planet then spanking you can blow my
legacy well because maybe there is no
such thing back then without a permit
because we don't care there was no
legacy leave their security box right
okay what do we do because i love babies
indicators it sort of bugs going forward
is the bugs you currently finding so
that while you can't ship this where we
were stripping in federer the next year
2000 turn
so what we decided to do is a really
really gutsy move there's a team side
we'll put everyone back through security
training and learn without the federal
thing and my please see available
education for us then where it is wholly
developers if you're looking for these
kinds of bugs program managers an
architect's you need to get building
flood be go back over you threat models
again and piracy me amidst test is
because you're doing these resource of
things and we're moments of the incoming
bug right and we're done then the bug
rated basically flat lines which is
fascinating because we're shipping in
February the whole thing is our stop in
mid-november and go as long as it had to
go until the incoming bug right flatline
obviously have no idea what that they
know is going to be with the Moscone
Center booked for shipping the dotnet
framework in February for Alice's got a
gutsy isn't also know that making
changes um mostly right years be leery
of making changes this late in the game
slowly advantage you know you make a
change to a ball if it's a bug you can
introduce new bugs well you open the
window flutter fly out until flies fly
in it's the only leverage right okay so
we were expensive about introducing
regressions by chain fixing bugs II
don't get it he explains monocular
deliver a fly out through fly to flies
come back in again so that was like
unremember early December we found about
half a dozen bugs that all got fixed but
one thing that we did do which is where
the biggest gutsiest move wherever we've
ever done so back then how did have you
use asp.net before version 1 by the beta
of it okay you're lucky because back
then in the beta asp.net I'm not kidding
here running system context we service
all right you're shipping this way
so while we are it was like this
December and we're shipping in February
and we don't invest their designs are
booked and it's not a trivial change I'm
going to run all the tests for every
single test again when our would be
bugging scenarios will break we know
that our third-party vendors who build
on top of this and expect their
debugging scenarios to work will all
break okay your security good good makes
the play so that weird if a duck's back
well Cara oh crap so and that's a look
how many uses we use a spell how many
people will actually touch a speed on
that applications billions right
billions of users oh no the users
billions of page views billions of heads
how many people will be but like be
hardcore debugging asp.net applications
five people write a foreigner in redmond
this is billions and billions of
billions of people right billions of
page views this is five people I meant
to build the five people to protect the
billions and billions and billions of
page views they got that so you switched
it out form a linear system context to
bellian network service the much much
lower pretty low privileged account if
you compromise it if you're not just got
on the box all of a sudden you're not
you're very planet to get to a
privileged account we made that change
the field version then shipped the crazy
thing is is that it's the best decision
we ever met we probably been fierce to
make a decision anyway not to be mnship
have been deployed and millions of
websites who doesn't have millions of
Russians could a respectable work is
absolutely right decision to make
absolutely right decisions made we also
added a new marriage code attribute I've
called a lot of policies allow party
trust of callers attribute which
basically took a bunch of code and said
uh I allow basically untrusted code to
call me and by default we would know
where untrusted code to call sir managed
code assemblies so each we reduce the
attack surface of the dotnet framework
and their speed on that substantially
their design changes which is exactly
not the thing you're gonna be real happy
for your ship especially that with my
lady sends a book and its assembly else
actually happened at this point I've
let's talk about it on so Devin the
blanket idea whether working on running
secure cleric and December mr. December
eight 2001 the first edition started
coming out the first copy started coming
out like that I my hand with a couple of
copies when December the 12th I the
meeting at gate with a well mmm meeting
for four hours to go through security
bugs because here to understand more
than an ultra security bugs and I had
like thirty five slides we covered 55
started four hours because I only have
this question after question after
question after question ESPYs like
professional have to question that's
only lets this question after question
but I real number one liver you're
talking to gates know your stuff
otherwise you'll tear you apart so is a
great meeting first copyright speaker
they gave the copyright secure code then
on the Monday that I fried on a Monday
he emailed me and said I read the book
every weekend absolutely love the book
which was the lead a limit of the second
edition to get gates to put the quotes
on the front of the book
and then last time you put a quote on
the book was an inside os/2 by Gordon
let one which I had a copy of signed by
Gordon wetland and there's comment to me
from grill at least thank you for thank
you for saving us from ourselves that's
the coming from wetland oh yeah um go
where the hell am I I'm but so that was
and the december 2001 the trustee
incompletely mckenna daily 2002 then we
had the windows security push when
februari 2002 we're basically model it
on the.net framework was because it was
so it was so successful but again it was
completely open ended we had no clue
when we were going to be done with any
family flatlined and bugs that's it
there are three tracks of education for
everyone in the windows division where
three tracks developer trailing and
design architecture program management
trailing and tash training is in charge
of developers like over developers and
remove my colleague Jason Gomes had all
the PM's and designers and Chris Walker
had tests and we lie just feed everyone
through and trailers mandatory for
everybody I'm just to get everyone to
baseline level of expertise I became
known in the security push and it says
here that be the size of the windows
code base is roughly 10 times that in
the clr focal the code size didn't
matter that much what mattered was a
most of cold code was all like web
legacy issues to worry about if I had my
way I would shoot back with
compatibility in the head in a heartbeat
I really would but I'm planet Earth you
can't do that you just can't because
mainly use your products well I'd love
to produce a version of any product
there was your totally secure but people
with low load their word documents met
PowerPoint documents and play their mp3s
and
play the WMDs and what will have you
know i would love to kill it back
compatibility but you're just Carly
that's a problem we faced in Windows now
this we actually started rivet and
Senate drive your first threat modeling
it was really kind of interesting with
their money to him I'll be free I wrote
as an experiment in writing client-side
JavaScript let sucked and that's why the
early days people hated threat moment
Microsoft is oh my fault and the tree
was cracked absolutely ridiculously
impossible to use it was my first foray
into using javascript on the client yeah
let me do it again there's a bit of a
mess of Bates of no confidence in my
JavaScript skills back then there's feel
pretty good pretty good thing about you
guys well they understand JavaScript as
it stands today anyway and easily also
started first even people I'm prefix
giving people bug reports they get here
ladies bugs in your code now look in
triage them and fix them and here's how
to fix it by then stay running desktop
analysis pre fast that will introduce
that which is basically just a bit
essentially into a trap procedural
static analysis as opposed to
interprocedural which your prefixes you
can't run prefix on the desktop it's
just too big Baylor you're way too big
and it's just unwieldly when we do nun
prefix centrally as a personal middle as
desktop we also added this thing called
security order we change the choice
known to the final security review
because bank has been like like is using
the word order and they're obvious
reasons it has some implications the
joined the f sr or the security order
back then we're going to make sure that
you are secure is to make sure that you
are complying with the sdl that's it
that's where for we make sure you've
done all the right things when give you
a tip at the end a man a perfect
find us by nothing during their pensar
but on planet earth there's always
something especially for the bigger
products and the limited form however is
that how they push a security push well
beneficial is not scalable it's just not
you can't write stuff the right before
your ship let's go look for some
security bugs and fix them you just
can't do that it really it really does
not work and so this area started
talking to the leadership team about
changing the process now changing the
way we build software microsoft and they
didn't have three options option of the
realm of do nothing i hope the problem
goes away yeah whatever the second was
totally without our current available
practices in place with something brand
new which by the way no one knew of that
brand new was going to be that's not an
apple right and the limited daily
Microsoft believe it or not can actually
ship software that's what we do it but
everything about shipping software
that's it actually had a process that
actually we're not always on time but we
get shot big do yourself a deal there's
nowhere we could jeopardize that the
owner is hybrid approach which is taking
existing processes and augmenting it
their security requirements and privacy
requirements today there are 100 and I'm
gonna say 129 such requirements it's in
that ballpark the changes from version
to version but it is over 100 that we
have 100 requirements and there's a
study talking now what this is a really
codifying attacks webs analysis what it
meant they're meant to reduce attack
surface how much code and functionality
will expose to interested users and so
these are building tools around
measuring it as well so a 2004 is where
we really sad
codifying the SDR there's some of it no
party had his name this occurs to them a
life cycle I was based on 1 ammore with
learned during the dotnet windows
securely pushes Malone app was also
green from 617 exchange office they all
have many pictures as well so certainly
like that we're well in these bushes
happened which one is fair most books
which one didn't provide a ton of
friction and sit down books because I
crb I'll be honest with those add
something that is so had it towed in
pain Jesus shipping software software
the lab is of no use to anybody so folks
a lot and B is no fiction as possible
you know the thing is I how the heck you
do not fictional over 120 requirements
most in a low-friction they are looking
to add tools looking to to upload all
this stuff will make a really really
streamlined and we're supposed to make
sure people have their thermals implants
make sure they have essentially art is
done we say documented in the fs are
actually meant the things that we're
going to look at where is a style to
require the use of native c and c++
defense memory corruption defenses
Starbase buffalo will detection may
execute and safe exception handling
you're going to realize back then we had
no es a lot address space layout
randomization now have two winter
windows vista so he required these from
day one no a mess of the player making
as no picture as possible we weren't
really really closely with the developer
division to have these enabled by
default in the compiler and linker right
so today if you go see all space food on
CPP you get all these on by default
there's no need to add a link a flagger
compiler flag you get them by default
this is no fiction as you can get
nothing changed except the editor
defenses by default to me like that the
biggest and trimmers and pull words are
by default just make it the default and
we know if you had a clear case of
doesn't work turn it off say GS they get
an exception through the stl process we
have an exception process there are some
components that don't work correctly GS
we're extremely rare there is an
exception process people who go through
the cow just turn your turn it off
that's a terrible detective I'll turn it
off by the way we know they turn it off
there we go through the exception
process and the bug bite or 20 hours
before we now added this so basically if
you were at any point if you have if you
have a bug and is being critical or
important you have to fix them it
doesn't matter where you are in
development life cycle you have to fix
it now the cool thing is is people will
say you're also so I don't think that's
exploitable the bug bar there have been
really into exploitability its
accessibility no exploitability its
accessibility I laid out here i'm not
going to start playing chicken with a
memory corruption bug that's extremely
accessible I'm not and so the bug bug
codifies all of that and guess what a
lot of the arguments because it's very
very concrete is very very well-defined
we know exactly what a critical bug is
where is that introducing fuzzing here
in the early days or just file and RPC
endpoints everyone millinery or guess yr
pc endpoints get it closed that's a B
and runs it faster I decisive BR this is
isaac faster the blaster worm right
that's why i said if as we are PC
endpoints that's why windows XP service
pack 2 the RPC one tile is broken up
into two chunks and if you notice that
we will know let's be serious back to
the RPC Alzheimer's well service the
running system context it turned out the
code fresh you doing RPC stop the
military
context the code the starting remote
decal objects had surrendered system
context which is very rarely call so in
windows XP service pack so we broke up
into two services the very very
high-profile extremely exposed RPC one
time runs in methanol privileged versus
the wonderful starting decom objects is
harder to get to the code is much much
smaller and it runs in system context
great example of your separate email
service into discrete chunks it took
like six months to do that work on the
way there was a lot of work that's why
we defend our pc puzzling back then we
started introducing a cryptographic
standards as well Metin deform then be
five nashua even back then risa 2005 we
said no sha-1 now there's no Triple DES
no rc4 even if you use a billion bit a
billion bit KLC for that is still bad no
electronic code book of course CBC's now
that's an interesting in the weaknesses
as well so the record them back to the
stl crypto requirements about how you
use cipher block chaining as well versus
not introducing our very first rental
tools like a verifier FX cop those kinds
of tools for doing one child analysis of
applications we say fuzzy activex
control the next job three and three
that one as we and juice band on H this
is now about 120 functions or just
banned in the CC when time live
including them copy then copy it banned
the new code so to put in some tube in
perspective remembers this step we went
through the whole of Windows Vista and
removed else to a copy store cat stir
and copy steering cat s printf there
will no guesses by the way and there
were by a third of a million calls
they're all gone and placed with safer
versions we
so this point we read we have such a
healthy relationship with the developer
division we asked the developer division
in the c compiler to add the compilation
if they know the bucket size at one time
so no value compile time and there's a
call to a band OPI like square coffee
they automatically migrate the store
copy to a safer court during compilation
and don't omit a warning but the
function is deprecated some people don't
like that because we're changing the
code under the covers but frankly we
don't care if you don't like that you
can turn it off but frankly we don't
care and every argument of people have
as to that's me are you in a break
mackeir know or not show me one example
so I love it but they pierce armor about
wholesale tenderness / copies and spur
cats to these safer versions because I
don't get prefer these problems and
regressions how many regressions depend
upon occupies the theater million calls
in windows vista howdy aggressively
fight 11 and it was cold but actually we
live in the fact that spur coffee may
not null terminate the buffer seriously
so people covering the codes about ave
please and because it's so funny can
only chill tuned RM tools this cave like
right up over time but may not be Mel
terminated their win over and so this
has been special piece of code better is
one there's been no confirm these
problems and they forget I some part it
was in the mid two thousand the active
directory to or palliative your team now
we can replace the band API is with
these other API is that while a
performance is better suck like
seriously you guys there is doing very
very heavy
traffic notice the massive amounts of
disk i/o massive as a public key crypto
mass amounts of symmetric crypto and
you're worried about two clock cycles
really so when the changes code no
problems so cross-site scripting the
stem is not a dresser str 3.2 and so she
can judge from let's get X and all
pausing depend in an area where then
there's bugs background with
self-referencing dt DS so as you have an
XML file a bill to an infinite loop the
d2d of weapons itself go back to
everybody absolutely everybody and so
now you're hannah marks up is a minimum
x no one time if you already managed
code or native CSU press press there's a
native is a minute inversion number and
if you take that be tools so in the
middle your foil package within these
tools then you check the XML parser that
you're using it has two above a certain
sir version number we also released our
first documentation on the stl publicly
well it is a Vista 2007-2008 so the
added SLR to enlist booster minute we
made that a requirement in stl and
instead of a single cell the standard
levitation language as a recommendation
military salad they will know about it
for soon at the end but basically way of
describing the interface contract will
function so i'll give you a quick
example let's say you got a puncture it
takes two arguments a buffer and a size
you know those two values at I outside
of the hip right the buffer is that big
well the compiler is no clue also uses a
pointer in the 32 bit unsigned integer
where's Sal you can actually say that
buffer is that brick and no more than
that big so helps the tools find more
books
marion suppose contract little under two
cells and just out though and 2008-2009
Lester fire below required and safe and
arithmetic whether code written by
braving the belt primary by David 4am c
c++ safe integer arithmetic but also
this point added any new option or so a
new change to the compiler where we will
detect at one time automatically integer
area closed will call you operate in
there so if you go into very flowy for
new and see see professor / may yet be
implicit multiplication overflows will
kill your process the reliability guys
hunters we don't care we just found a
security building occurring with an ice
cream stacked Roach to the bug we don't
care at that point and the NSF program
the biggest thing we did here where's
the party licensing requirements going
back to our big vendors and saying
you're going to meet this minimum bar
otherwise you're not in the box the
windows box for example 2009 the first
released our public release of some of
our tools desktop for modding tool I'll
tell you right now the tool we use
internally the only change is what we
pull the boats too so a version that we
have internally the personal back in bug
reporting in for a circle park studio
which is of no use to any of you that's
the only difference the business product
available either reports to an XML file
or to team foundation server we also
released visual studio and templates
well
bin scope which is that and by the
allies or so we can set make sure that
you have to comply with risk a
requirement like GSS Allah safe
exception handling you c compiler
version number that kind of stuff we
also released a very simple file puzzle
as well which ball a very very large is
V who will remain nameless run mini fuzz
and found ten discrete bugs in one week
in their code or security bugs are
exploitable by running mini fuzz and
it's not a clever fuzzy I'll tell you
right now it's as dumb as a bucket of
rocks and then why bench usually involve
in since day one is sample play
requirements and Microsoft mail also
prepared is subject to the stl while
samples are not Santa's the templates
people copy paste if it's that's crap
guess what the crap perpetuates you know
there are kicking in school you on that
one we do a logical Ian screaming sound
a was supposed to show how you get
something done for yes securely yes
Omega s bestseller a requirements rather
the recommendation should point out as
griffons requirements are things that
you must do we can stop you from
shipping if you do not adhere to these
requirements recommendations that
believe that you should probably think
about especially if you're I AE the
developer comes negotiated commitments
their words uie you have very exposed
these are the five things we kind of
affects you and because you're ie you
should really do them and recommendation
of the UT stuff that's a little bit
harder to do maybe milk fiction or
something absolutely brand-new
so I'm not going through the timeline be
slides will be available but as you can
see the sdo has involved many many times
and that one out to sdl 52 I'm
internally although real crooked through
skin science members wrap things up this
is a discrete team that focuses on the
future is where we are our tax gala
welcome upon us what go put them in the
education LACMA perimeter and welcome to
put in visual studio to mitigate these
threats moving forward I can't say too
much about baseball say the biggest
batter will be in the windows a visual
studio tool set but biggest security
Delta to date it's going to massive
that's a big good quality changes lots
of good changes there I can't talk about
them obviously but always try to do that
so we saw massive tell you up the reins
windows vista on the tool set on top of
it we were in content windows seven so
yeah we'll see moresee things moving
forward so my office right officer it
going to keep raising the bar slowly and
i'll argue whether the real point of the
secure sales team is mitigating zero
days it's really what kind of balls down
too so don't thing that you can only be
slides where Barry shows is a
progression for windows XP to Windows 7
and have opted in for the different
defenses over time as it gets more and
more glue as we go over that way as we
have to opt into more mortgages of these
defenses semi windows server again you
can't leave this so look at the slide
later and the urge you guys if you guys
are building on Windows you need to opt
in for these defenses well I'm going to
melt over by default for your app and as
you can par with our mod with black hole
tools then for some reason some legacy
cases people don't do it anyway and so
is the big two by far our depth and X
and address space layout randomization
you've got to opt in for both
you're doing both together we've been
opened a lot of big eyes days at last 45
years to get my oil to opt into this and
the big ones appear letting anything
that runs inside of the browser you go
to opt to as well otherwise you become a
springboard for attacks that's why we're
we're really happy with java 7 come out
because finally all occur it added SLR
and depth support which prevents that
prevents the JVM than being a member and
spray ward out of all the protections
there in IE that's now gone so SOR as
I've I about six months ago are you
think that sort of the wave does feel a
terrible nearly about about twenty
percent not labeled a little by sector
is interesting there in the browser
clients now have it enable the DEP are
the debt basically by members they have
a mess longer 71 percent is enabled by
default and bisectors interesting again
all browsers now enable it by default
when you look at it by them different
sort of vertical it is not as a prettier
picture so the real call to action here
is that he will do if you're building
any code where that compact and x11
those r dl out get hold of a couple of
in scope run been scoping the binaries
if SLR and dec I'm not enabled by
default on any of your binders you need
to fix that so young eterna stress is
again you we believe the parts of the
ecosystem a security ecosystem it going
to do that by everybody being involved
with hardly a ass we get a lot of
tweeting so it's a lot easier for you
but is now to everybody stop up to him
for this stuff
so Celeste DRS interest in Les Tourelles
with our efforts I can't believe rather
than security so changes at Microsoft
with Lebanon place / fellows 10 years
which means it blows me away i remember
those those halcyon days um those
interested students become an accepted
industry leader even though you need so
it's like garlic and saying that you
know sdl is industry-leading it's not
perfect by any stretch and what will be
evolved a thing every year every celuyu
the University up I've got to step up
there were basically done is collapse a
lot of the requirements of single
requirements they can be measured by one
tool as opposed to like seven
requirements are measured by the same
tool make things easier for people so
here the questions feel free to email me
Mike Hale at microsoft com was website
mess up the comeback sdl better if you
know how hard it is to get like part of
the mic supcom domain to give you like
part of a URI space pretty hard there
you go so that one done by the time it
any milling around with your questions
feel free to hit and then yell at me
thank you very tired